Methods and systems for a portable data locker

ABSTRACT

The embodiments provide for binding files to an external drive, a secured external drive, or portable data locker. The files are bound in order to help restrict or to prevent access and modification by certain computers or users. Computers or users that are authorized or within the authorized domain are permitted full access. The files stored on the external drive may be bound in various ways. The files may be encapsulated in a wrapper that restricts the use and access to these files. The bound files may require execution of a specific application, plug-in, or extension. A computer may thus be required to execute program code that limits the use of the secured files. In one embodiment, the external drive provides the required program code to the computer. In other embodiments, the required program code may be downloaded from a network or provided by an external authority.

This application is a continuation of U.S. patent application Ser. No.12/916,342, (Attorney Docket No. T4436), filed on Oct. 29, 2010, whichis hereby incorporated by reference in its entirety.

DESCRIPTION OF THE EMBODIMENTS Background

In today's computing environment, businesses and enterprises struggle tocontrol their business data and information. The hard drives onemployees' computers often contain vast amounts of sensitive orconfidential information. Unfortunately, the typical security measuresprovide weak protection at best for such data even when the computers orusers are within a protected environment of a business. The challengesof protecting data is further heightened when employees are permitted towork from remote locations, such as their home, or use portable devices,such as laptop computers, smart phones, tablet computers, etc. Indeed,the proliferation of mobile computing devices has also made it moreimportant than ever to provide ways to protect sensitive andconfidential.

One known solution is to utilize a password-locked external hard drive.In order to access the drive, the user must enter a password on thedrive itself or via a software application. However, this solution isonly as strong as the password utilized. In addition, the storage mediumfrom the hard drive can still be removed or copied to circumvent thissolution.

Another known solution is to utilize disk encryption or file systemencryption. Unfortunately, encryption-based solutions can be processorintensive, time consuming, or inconvenient for the user. For example, auser may have to select on a file-by-file basis the various files toencrypt.

Accordingly, it would be desirable to provide a way for businesses andenterprises to control their information while allowing convenientaccess in a variety of applications.

SUMMARY

In an embodiment, a method of binding a file to an external drive isprovided. A file is saved to an external drive, wherein the file isbound to the external drive to restrict the file from being modified ormoved to another storage location in an unauthorized manner. When theexternal drive has been coupled to a second computer, access by thesecond computer to the file is restricted based on program codeexecuting on the second computer that restricts the second computer fromcopying and saving at least a portion of the file to a location otherthan the external drive.

In accordance with another embodiment, an external drive is configuredto limit access and use of a file from a first computing device when theexternal drive is coupled to another computing device. The externaldrive comprises: a storage medium for storing at least one file writtenfrom the first computing device; a communications interface; and aprocessor. The processor is configured by instructions to identify whena device that is not the first computing device has been coupled to thecommunications interface and to require the other device to executeprogram code that restricts the other computer from copying and savingat least a portion of the file to a location other than the storagemedium.

In accordance with another embodiment, a computing device is configuredwith restricted access to a file from another computing device that hasbeen stored on an external drive. The computing device comprises acommunications interface capable of being coupled to the external drive;a client application executing on the computing device that is capableof accessing the file from the external drive; and a processorconfigured by program code that is required by the external drive. Theprocessor is configured to restrict the client application from copyingand saving at least a portion of the file to a location other than theexternal drive.

Additional features of the embodiments will be set forth in part in thedescription which follows, and in part will be obvious from thedescription, or may be learned by practice of the embodiments. Theadvantages of the embodiments can be realized and attained by means ofthe elements and combinations particularly pointed out in the appendedclaims. It is to be understood that both the foregoing generaldescription and the following detailed description are exemplary andexplanatory only and are not restrictive of the embodiments, as claimed.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute apart of this specification, illustrate embodiments of the invention andtogether with the description, serve to explain the principles of theembodiments. In the Figures:

FIG. 1 shows a block diagram of an exemplary system that is consistentwith the present disclosure.

FIG. 2 shows a block diagram of an exemplary external drive that isimplemented as a portable data locker device in accordance with anembodiment of the present disclosure.

FIG. 3 shows an exemplary process flow for controlling access to a filein accordance with an embodiment of the present disclosure.

FIGS. 4A-4C show exemplary block diagrams of a computing deviceaccessing a file that has been bound to a personal data locker inaccordance with embodiments of the present disclosure.

FIGS. 5A-5B illustrate a computing device accessing a file bound to apersonal data locker in accordance with embodiments of the presentdisclosure.

FIGS. 6A-6B illustrate another example of a computing device accessing afile bound to a personal data locker in accordance with embodiments ofthe present disclosure.

DESCRIPTION OF THE EMBODIMENTS

The embodiments provide systems and methods for binding files to anexternal drive. The external drive may be a secured external drive orportable data locker. The files are bound to the external drive to helpto restrict or to prevent access by certain computers or users. Users orcomputers that are authorized or within an authorized domain arepermitted full access to the bound files for editing, copying, printing,etc. Various uses and applications of the external drive may be apparentto those skilled in the art.

For example, an employee may initially save and bind files to theexternal drive while at work on an approved network. Once bound to theexternal drive, the employee may then take the external drive and workon the files, for example, while at home or traveling. The externaldrive is configured to protect the files and prevent the employee fromcopying the files to an unauthorized storage location or to anunauthorized computer, while still allowing him to modify the files

The embodiments may also allow an enterprise or business to collaboratewith other organizations. For example, employees from one organizationmay save various files to an external drive, such as drawings,documents, etc., that may need to be shared, but contain sensitive orconfidential information. The external drive may then be provided toanother organization, allowing relevant parties to access or modify thefiles bound to the external drive while helping to ensure the files arereturned with the external drive. In accordance with the embodiments,the files remain protected and their dissemination can be controlled. Inthis instance, files may optionally be prohibited from being edited.

As yet another example, in the embodiments, the files bound to theexternal drive may be secured based on the user's identity or role aswell as the device or computer being used to access the external drive.Hence, users from one department, such as engineering, may be restrictedin accessing files from another department, such as marketing orfinance, that are bound to the external drive. Therefore, the externaldrive can serve as a secured storage location or archive for files andprovide various levels of security.

Accordingly, the restrictions and access controls enforced for filesbound to the external drive of the embodiments can apply to devices,computers, or users, alone or in combination. Authentication andauthorization, including the ability to make changes to the file may bedetermined at a variety of levels in the embodiments.

The files stored on the external drive may be bound to the drive invarious ways. For example, the files may be encapsulated in a wrapperthat restricts the use and access to these files when accessed bycertain computers or users, or require execution of a plug-in. In orderto access the files bound to an external drive, the computer is thusrequired to execute program code that limits the use of the securedfiles. In one embodiment, the external drive provides the program codeto the computer so that it may access the secured files. In otherembodiments, the program code for accessing the bound files may bedownloaded from a network or provided by an external authority.

Accordingly, among other things, the embodiments allow for expanded ormore flexible secured or restricted use of files by an organization. Forexample, an employee of a company may need or desire to work on a filewhile traveling or while working from home. However, the contents of thefile may be sensitive or proprietary to the company. The embodimentsallow the file to be bound to a device, i.e., an external drive, and thecontents of the file to be protected when accessed in an otherwiseunsecure environment. These and other use-cases for binding files to anexternal drive are consistent with the present disclosure.

Various embodiments of the present disclosure will now be described withreference to the accompanying figures, wherein like numerals may referto like elements throughout. FIG. 1 shows a block diagram of anexemplary system 100 that is consistent with the present disclosure. Asshown, the system 100 may comprise a trusted domain 102, a domain 104that is external to the trusted domain 102, a network 106, and(optionally) an external authority 108. These components of system 100will now be further described.

Trusted domain 102 conceptually refers to a collection of one or moredevices, such as an authorized computer 110, which have read, write, andedit access to a set of files, such as file 212 (as shown in FIG. 2).For example, the trusted domain 102 may represent the network andcomputer systems of a business or enterprise. Trusted domain 102 mayalso have various trust relationships with other domains that areone-way or two-way. For example, users of trusted domain 102 may haveaccess to other domains, but the trusted domain 102 may not allow accessby external users. As another example, the trusted domain 102 may havetwo-way trust with another domain (not shown) that it trusts, and thus,users of both domains may access each other's domain.

As shown, trusted domain 102 may comprise an authorized computer 110that is coupled to a trusted storage 112. The authorized computer 110represents any computing device that may be used by a user or employeewithin the trusted domain 102. For example, the authorized computer 110may be a personal computer, a server, a laptop computer, a smart phone,a tablet computer, and the like. Any type of computing device that iscapable of creating, modifying, and accessing a file may be consideredan authorized computer 110 or part of the trusted domain 102.

In typical operation, a user may use authorized computer 110 to createvarious files and documents using well-known applications, such as wordprocessors, spreadsheets, presentation software like those provided byMicrosoft Office, and the like. Such files may then be stored on trustedstorage 112. In the embodiments, the files may be stored in encrypted orunencrypted form depending on the desires of the user or the businessrules and policies of the trusted domain 102.

Trusted storage 112 refers to the storage coupled to the authorizedcomputer 110 or any storage residing within the trusted domain 102. Forexample, the trusted storage 112 may be the hard disk drive of theauthorized computer 110. Alternatively, the trusted storage 112 may be aremote storage, such as one or more network attached storage devices orservers, that are coupled to the authorized computer 110 within thetrusted domain 102.

Portable data locker (PDL) 114 serves as a device that can be takenoutside of the trusted domain 102 yet still provides a way to restrictaccess to files from the trusted domain 102. In particular, filescreated within the trusted domain 102 may be saved, copied, or writtento the PDL 114. The PDL 114 is configured to bind these files in such amanner that the files are restricted from being accessed or edited byanother device (such as second device 116) or moved to another storagelocation if outside of trusted domain 102. These and other features ofthe PDL 114 may thus allow a user or employee to take the PDL 114 toanother location and access various files in an acceptable or securemanner when outside of the trusted domain 102.

In the embodiments, the PDL 114 is implemented based on a portableexternal hard disk drive, such as those made by Western DigitalTechnologies, Inc. In addition, the PDL may be implemented as a portablesolid-state memory device, portable hybrid solid state/hard disk drive,optical drives, and/or the like.

As to external domain 104, this domain refers to any device orcollection of devices that are un-trusted or not part of the trusteddomain 102. For example, the external domain 104 may refer to a computerused in public, a user's home computer, and/or the like.

Second device 116 represents a computing device that is part of domain104, i.e., external or not trusted by the trusted domain 102. Forexample, the second device 116 may be a personal computer, a server, alaptop computer, a smart phone, a tablet computer, and the like. Anytype of computing device that is capable of creating, modifying, andaccessing a file may be used as the second device 116. In addition, thesecond device 116 may utilize various software applications to access afile, such as word processors, spreadsheets, presentation software likethose provided by Microsoft Office, and the like.

As also shown, the PDL 114 may be taken outside of the trusted domain102 and coupled to another device, such as the second device 116.However, as will be explained further below, the various files may bebound to the PDL 114 and access to these files by the second device 116may be restricted in various ways. For example, the second device 116may be allowed to modify a file, but only allowed to store or copy thefile or portions of the file to the PDL 114.

Network 106 represents the communication infrastructure for system 100.For example, network 106 may comprise various local area and wide areanetworks. In addition, network 106 can comprise both voice and datanetworks known by those skilled in the art. In some embodiments, network106 comprises the Internet. Of course, network 106 may represent othernetworks that couple the components of system 100.

External authority 108 is an optional component of the system 100 toassist the PDL 114 in controlling access to various files. For example,external authority 108 may serve as a third-party authentication andauthorization service for the system 100. In some embodiments, theexternal authority 108 may provide the various software and program codeneeded by the second device 116 to access files on the PDL 114. Inaddition, the external authority 108 may provide other information, suchas meta-data and policy files, used by the second device 116 whenaccessing files on the PDL 114. For example, the external authority 108may specify when access to various files on the PDL 114 is revoked orspecify a limited number of devices that can be mated or coupled to thePDL 114. In addition, the external authority 108 may provide various keymanagement services, such as public key infrastructure services, to thesecond device 116 when accessing files on the PDL 114.

External authority 108 may be implemented using one or more servers,such as an access control server, a certificate authority, and the like.Such components are known to those skilled in the art. For example, theexternal authority 108 may implement the Kerberos protocol to assist thesecond device 116 when accessing files on the PDL 114.

In some embodiments, the external authority 108 may also provide anupdate service to specify when access to the files on the PDL 114 hasbeen modified or revoked. Modification or revocation can be initiatedbased on a time interval or based on the occurrence of certain events,such as after a threshold number of accesses, or when a breach has beendetected. For example, the external authority 108 may periodically orcontinuously provide revocation updates via the network 106. In someembodiments, as part of its operations or start-up sequence, the PDL 114may retrieve or be required to receive this information from theexternal authority 108. This update information may be provided invarious formats, such as a set of permissions, a set of restrictions,key protocols, key rotation algorithms, digital signatures, etc. Theupdate information may also be encrypted or otherwise secured in orderto protect the information during transmission from the externalauthority 108. As another example, the external authority 108 may sendpolicy updates or revocations upon the detection of a breach or otherevent at PDL 114. This update or revocation may comprise information topatch or remedy the cause of the breach. Thus, the update service of theexternal authority 108 allows the PDL 114 to dynamically implement itsbinding and overcome various hacking or intrusion efforts by thirdparties when they may occur.

In some embodiments, the external authority 108 is also configured torequest or receive logging information from the PDL 114. The PDL 114 mayprovide log information on a continuous or periodic basis.Alternatively, the PDL 114 may be configured to upload its loginformation to the external authority 108 upon the occurrence of certainevents, such as when a breach has been detected or when an error hasoccurred on the PDL 114. The external authority 108 may then performvarious analyses of the log information. For example, if desired, theexternal authority 108 may provide a trace service to locate one or moreusers suspected of breaching the security of the PDL 114 or attemptingvarious unauthorized operations on files bound to the PDL 114.

Alternatively, the PDL 114 may provide to the second device 116 theprogram code, meta-data, policy information, etc. For example, uponstart-up, the PDL 114 may be configured to install program code orsoftware on the second device 116 before allowing any access to itsstorage medium. As another example, the PDL 114 may be configured tointerrogate or challenge the second device 116 to present one or morecredentials before it allows access to any files stored on its storagemedium. For example, the PDL 114 may include a partition that representsitself as a Virtual CD which may include an auto-run feature. As anotherexample, the PDL 114 may utilize an auto-run or auto-play feature, suchas those provided by the Microsoft Windows™ operating system, thatinitiates installation of a driver and/or program code for the PDL 114on to the second device 116.

FIG. 2 shows a block diagram of an exemplary external drive that isimplemented as a portable data locker (PDL) 114 in accordance with anembodiment of the present disclosure. As shown, the PDL 114 may comprisea control processor 200, an input/output 202, a memory 204 having a keyregister 206 and storing one or more encryption keys 208, a storagemedium 210, a file 212 that is to be protected by the PDL 114, and abinding application 214. These components will now be further described.

Control processor 200 represents the logic and circuitry that carriesout the storage control functions of personal archive device 106. Forexample, control processor 200 may be general purpose CPU, such as thosemade by Intel Corporation. Alternatively, control processor 200 may beimplemented using other forms of processors and circuitry. For example,control processor 200 may be implemented based on a field-programmablegate array (FPGA) or application specific integrated circuit (ASIC).

In some embodiments, control processor 200 may also comprise encryptionhardware for encrypting and decrypting contents stored on the PDL 114.The encryption hardware may be integrated as a component of the controlprocessor 200 or may be implemented as a companion device, such as aco-processor, that is coupled to the control processor 200. In someembodiments, the PDL 114 is configured to support various encryptionstandards, such as Advanced Encryption Standard (AES).

Input/output 202 serves as the communications interface for personalarchive device. For example, input/output 202 may comprise interfaces,such as SCSI, USB, IEEE 1394, Firewire, eSATA, HDMI, and the like toallow the PDL 114 to connect to other devices, such as authorizedcomputer 110 or second device 116.

Memory 204 serves as a temporary storage memory for the PDL 114. Forexample, memory 204 may serve as the storage for instructions beingexecuted by control processor 200. Memory 204 may be implemented usingvarious types of memory both volatile and non-volatile. For example,memory 204 may be implemented using RAM, DDR RAM, SDRAM, DRAM, ROM,PROM, EPROM, EEPROM, flash memory, etc.

Key register 206 serves as a temporary storage for the various keys,such as encryption keys 208 used in the embodiments. Control processor200 may thus use key register 206 for its key management requirements.In some embodiments, the key register 206 is located such that it isgenerally inaccessible to a user, such as within a hidden portion of thememory 204 and/or a hidden sector of the storage medium 210.

Key register 206 may store various types of keys, including identitykeys to authenticate the identity of the PDL 114 or a user of the PDL114, keys used to encrypt sensitive data, such as key material,passwords, etc., and binding keys used to bind one or more files, suchas file 212, to the PDL 114.

Storage medium 210 is a storage medium and is configured as a controlledenvironment in which various files are bound to the PDL 114. Forexample, the PDL 114 may bind a file based on some unique feature, suchas a serial number from memory 204, MAC addresses, etc. of the PDL 114.For example, a file may be locked to the PDL 114 based on afingerprinting of storage medium 210. The fingerprinting may beaccomplished through spectral signatures of storage medium 210 orthrough drive defect signatures. For example, content locking featuresare described in U.S. Pat. No. 6,799,274 entitled “Device ComprisingEncryption Circuitry Enabled by Comparing an Operating SpectralSignature to an Initial Spectral Signature,” to Hamlin, which is hereinincorporated by reference in its entirety. In various embodiments, thestorage medium 210 may be implemented as one or more hard disk drives,such as those made by Western Digital Technologies, solid state devices,hybrid solid state/hard disk drives, and/or the like.

File 212 represents any file to which a user may desire access. Suchfiles and file types are well known to those skilled in the art. Whenstored on the PDL 114, the file 212 may be stored in encrypted orunencrypted form. In some embodiments, the file 212 is stored based on astandard file type, such as .txt, .doc, .ppt, .xls, etc. In otherembodiments, the file 212 is wrapped or encapsulated in a wrapper thatrequires a specific software application or driver to open.

In some embodiments, a binding application 214 may be installed on thePDL 114. Binding application 214 is an application installed on the PDL114 that binds the file 212 to the PDL 114 and cooperates with thesecond device 116 to control or restrict access to the file 212. Bindingapplication 214 may be implemented via instructions executed by controlprocessor 200. For example, the PDL 114 may execute the bindingapplication 214 to strengthen or make the binding of file 212 morerestrictive. The binding application 214 may also be utilized ininstances where the second device 116 has limited processing resourcesor limited applications, such as a mobile device, a tablet computer, asmart phone, etc. Alternatively, in some embodiments, the bindingapplication 214 is integrated into the program code installed on thesecond device 116 or the functions of the binding application 214 areperformed by an application running on the second device 116. In someembodiments, the binding application 214 is configured to avoid externalanalysis or intrusion. For example, the binding application 214 mayutilize rotating keys or self-expiring code that deletes itself aftereach use or after a certain period of time. The binding application 214may also employ encrypted or other secure communications with otherapplications or devices to avoid, for example, protocol analysis. Asnoted above, the binding application 214 may also be configured toimplement a plurality of encryption functions and protocols that aredynamically selected. Thus, the behavior of the binding application 214can be adapted depending upon the detected environment or upon detectionof a security breach or intrusion. In some embodiments, this dynamicbehavior is managed by the PDL 114 to make the user experiencerelatively transparent.

When coupled to a device, the binding application 214 determines whetherthe PDL 114 is within a trusted environment, such as trusted domain 102,and then selectively provides access to the file 212 accordingly. If thebinding application 214 determines that it is not within the trusteddomain 102 and instead within an untrusted or unknown location, such asexternal domain 104, then the binding application 214 will require thedevice 116 to attest to its suitability for access to the file 212. Forexample, the binding application 214 may require the presence of varioussecurity measures, such as file system permissions, plug-ins,applications, and application extension, on the second device 116. Thebinding application 214 may also verify various aspects of the seconddevice 116, such as its hardware components, firmware, operating system,and software licensing.

Alternatively, the binding application 214 may be a special purposeapplication that is specific to the PDL 114, but utilizes existingapplications, such as word processors, spreadsheets, browsers, etc. inan embedded fashion. For example, the manufacture or authorized vendorof the PDL 114 may provide the special purpose application on the PDL114 itself, via an associated medium, such as an optical disc, or via adownload, such as from a website. Hence, in these embodiments, thebinding application 214 provides a secure version or secure framework ofan application to protect the binding of the files. In theseembodiments, such versions of the binding application 214 may beexecuted based on a special file extension or wrapper that is generatedwhen a file is bound to the PDL 114.

The binding application 214 may perform auditing and logging functionsto record operations attempted and performed on the PDL 114. Forexample, the binding application 214 may transparently recordinformation, such as date and time of access, information about thesecond device 116, the application requesting access to the file 212,etc. In some embodiments, this audit and logging information is securedand/or encrypted to prevent tampering. In addition, the audit andlogging information may be transferred or otherwise sent to anotherlocation, such as the external authority 108, for services like analysisor monitoring. This transfer may occur based on a periodic schedule orbased on an event, such as detection of a security breach or uponreaching a threshold condition like age, number of operations, etc.

Furthermore, upon detecting an improper access or unauthorized tamperingof the PDL 114, the binding application 214 may be configured to performvarious alerting and security actions. For example, the bindingapplication 214 may display a warning message to be displayed on the PDL114 or on the second device 116. The binding application 214 may also beconfigured to send a warning message or alarm to a specifieddestination, such as external authority 108 or authorized computer 110.The message may be routed through the network 106 in various forms, suchas an email, a HTTP message, a text message, etc. In addition, ifdesired or necessary, the binding application 214 may be configured torender the contents of the PDL 114 unreadable or inaccessible. Forexample, the binding application 214 may delete the contents of the keyregister 206 or overwrite the contents of its storage 210.

FIG. 3 shows an exemplary process flow for controlling access to a filein accordance with an embodiment of the present disclosure. In stage300, a file 212 is created. For example, a user of authorized computer110 may use an application, such as a word processor, a spreadsheet,etc. to create the file 212. Optionally, the user then may store thefile 212 in trusted storage 112. The file 212 may also originate fromanother computer within the trusted domain 102 or may be a file that hasbeen previously stored in trusted storage 112.

As noted, controlling access to a file bound to the PDL 114 may bedesirable in a number of situations. For example, the embodiments canenable files bound to the PDL 114 to be accessed and allowed to beoptionally modified in different locations, such as an employee workingat home or while on travel. The embodiments also enable files to besecurely shared and restricted between organizations, such as companiesworking together on a project and wishing to share certain sensitiveinformation. As yet another example, the embodiments allow forauthentication and authorization for access and or modification to fileson the PDL 114 at a variety of levels alone or in combination. Inparticular, the authentication and authorization to files on the PDL 114may be based on the identity or role of a user as well as thecharacteristics and location of computer or device. Reference will nowbe made to FIG. 3 to illustrate an exemplary process flow of theembodiments.

In stage 302, the file is saved or written to the PDL 114. For example,the user may connect the PDL 114 to the authorized computer 110, such asvia a USB connection. The PDL 114 may then authenticate the authorizedcomputer 110. For example, the PDL 114 may check for uniquecharacteristics of the authorized computer 110, such as a serial number,a MAC address, an IP address within a given domain/range, etc. The PDL114 may also utilize other authentication schemes, such as a mutualauthentication using symmetric keys, public key cryptography, digitalcertificates, etc. Alternatively, the PDL 114 may check the authorizedcomputer 110 to determine if a specific set of program code, such as adriver, application plug-in, etc. is installed on the authorizedcomputer 110. Moreover, the PDL 114 may implement drive lockertechnology that specifies a certain number of devices that can be matedor coupled to the PDL 114.

In stage 304, the file 212 is bound to the PDL 114. In some embodiments,the binding of the file 212 to the PDL 114 is performed as a required ortransparent part of saving or writing the file to the PDL 114. Forexample, when saving the file 212, the user may be presented the optionof binding the file 212. Furthermore, the user may specify varioussecurity measures, such as a PIN or password that will be required toaccess the file 212 when it is stored on the PDL 114. As anotherexample, the binding of the file 212 to the PDL 114 may be performedbased on saving the file 212 as a special file type or within a wrapper.Accordingly, this stage may be performed automatically without the needfor user intervention.

Alternatively, the binding of the file 212 may be performed with someuser interaction, such as a request for a confirmation, entry of apassword, etc. Furthermore, the binding of the file 212 may berestricted to various extents. For example, the file 212 may be bound tothe PDL 114 based on various file system permissions and/or accesscontrol lists specifying read, write, and modify permissions at thedrive, volume, directory, or file level on the PDL 114. The file 212 mayalso be bound to the PDL 114 such that only certain hardware,applications or operating systems are able to access the file 212. Forexample, the binding of the file 212 may limit access to a specificoperating system or a specific type of device, such as server or apersonal computer.

The file 212 may be bound to the PDL 114 in various ways. For example,the binding application 214 may encrypt one or more portions of the file212 using one or more keys from the key register 206. In otherembodiments, the file 212 may be bound to the PDL 114 based onrestricting or preventing various operations with program code that willbe installed on the second device 116. Examples of such program code arealso illustrated with reference to FIGS. 4A-4C. In yet otherembodiments, the binding application 214 may wrap the file 212 in awrapper that requires another device, such as second device 116, toexecute a specific software application that is recognized by the PDL114 and limits the access to the file 212. Accordingly, in theembodiments, the file 212 may be bound to the PDL 114 with or withoutthe use of encryption. This feature allows the file 212 to be bound tovarious extents to the PDL 114. For example, files having highlysensitive content may be bound to the PDL 114 using a combination ofencrypted and unencrypted binding techniques. In contrast, files havingless sensitive content may be bound to the PDL 114 using simpler or lessextensive binding techniques, such as file system permissionsimplemented by the PDL 114 or configured into the second device 116.

In some embodiments, the binding of the file 212 may also specify otherpolicy features. For example, the binding of the file 212 may beconfigured with a specific expiration date, a revocation, or requiredrenewal date. In some embodiments, when accessed, the PDL 114 may beconfigured to access a device in the trusted domain 102 and/or theexternal authority for policy information regarding the binding of thefile 212. For example, upon start up, the PDL 114 may be configured torequest an update for its bindings from the external authority 108. Inresponse, the PDL 114 may receive updates for a wide variety of aspectsof the policy, such as changes to the policy, revocation of varioususers, permissions or computers, notification of a possible breach orintrusion on another PDL. The PDL 114 may implement these changes orupdates immediately and request confirmation from the computer or user.Alternatively, if necessary or desired, the PDL 114 may perform variousoperations to render the file unreadable, such writing over varioussectors, deleting various keys, and the like. In some embodiments, thePDL 114 may implement a recovery mechanism. However, the recovery mayrequire special privileges or additional measures, such asadministrative rights or authorization from an external source, such asexternal authority 108.

In stage 306, the PDL 114 is coupled to another computing device, suchas authorized computer 110 or second device 116. The PDL 114 thendetermines if it is coupled to the authorized computer 110, within atrusted domain 102, or outside of trusted domain 102, e.g., externaldomain 104. For example, the binding application 214 may query theauthorized computer 110 for a credential, such as an encryption key, adigital certificate, a digital signature, password, etc. As anotherexample, the binding application 214 may check with the externalauthority 108 to determine if the PDL 114 is still within the trusteddomain 102. If within an authorized or trusted environment, processingflows to stage 308.

In stage 308, the PDL 114 has determined that it is coupled to theauthorized computer 110 or within trusted domain 102 and then permitsaccess to the file 212. In some embodiments, since the PDL 114 is withinthe trusted domain 102, the PDL 114 may generally allow unrestricted orrelatively unrestricted access to the file 212. For example, the PDL 114may allow the file 212 to be modified, copied, and saved to anotherlocation, such as trusted storage 112.

If the PDL 114 recognizes that it is coupled to a new device, such assecond device 116, or in an external domain 104, then processing flowsto stage 310. In some embodiments, the PDL 114 detects when it has beencoupled to another device and may be configured as an auto-play orauto-run device. For example, the PDL 114 may be configured to mountitself on to the second device 116 such that it is interpreted as aCD-ROM drive. In some embodiments, the PDL 114 may require the user toauthenticate their identity, such as with a PIN or a password. The usermay enter this authentication information via the second device 116 or(if configured) directly on to the PDL 114. In yet other embodiments,the PDL 114 may be provided a dedicated application that runs from thePDL 114 for the user to enter authentication information.

In stage 310, the PDL 114 permits access to the file 212, but mayrestrict various uses and operations to ensure that file 212 remainsprotected. For example, the binding application 214 may automaticallyinstall program code, such as an application, an application plug-in,and the like that restricts or prevents write operations to the localhard disk of the second device 116. For example, as noted above, the PDL114 may include a partition that represents itself as a virtual CD(VCD), which may include an auto-run feature. Alternatively, the PDL 114may utilize an auto-run or auto-play feature, such as those provided bythe operating system of the second device 116 that automaticallyinitiates installation of a driver and/or program code for the PDL 114on to the second device 116.

The program code may also prevent or restrict write operations to astorage device, such as a USB device, that has been coupled to thesecond device 116. As another example, the PDL 114 may check for aspecific application or program code that has been previously installedon the second device 116 before allowing access to the file 212. Theprogram code may also implement operating system level features, such asfile system permissions and access control lists. The program code maythus protect the PDL 114 and the file 212 at a drive level, volumelevel, directory level, or file level. The program code may also protectitself from tampering or analysis by using self-deleting orself-expiring code. That is, the program code may be configured todelete or uninstall itself at various times, such as after each use orafter a threshold number of uses. The program code may also employfeatures, such as expiring sessions keys or rotating keys, to avoidtampering or analysis.

In the embodiments, the second device 116 may be restricted in variousways. For example, the second device 116 may be restricted from copyingor saving portions of the file 212 to a location other than the PDL 114.Upon confirmation of the appropriate program code being installed on thesecond device 116, or confirmation by the binding application 214, thesecond device 116 is permitted access to the file 212 bound to the PDL114. For example, a user of the second device 116 may be shown adisplay, a listing, a pop-up window, etc., indicating that the file 212may now be opened on the second device 116.

Applications running on the second device 116 may be restricted in theiroperations. For example, operation that may be restricted or preventedmay include edit, copy, save, save as, new, printing, rename, open with,etc. Access to other applications, such as the clipboard application,text editor, terminal emulation, etc., may also be restricted to preventunauthorized operations and protect the binding of the files to the PDL114. In addition, the applications running on the second device 116 maybe restricted or prevented from saving to a location other than the PDL114. For example, the operations of applications running on the seconddevice 116 may be monitored by program code installed on the seconddevice 116, such as a plug-in, a kernel filter, etc. As noted, certaincommands or operations, such as write operations, copy commands, savecommands, etc. may be intercepted and evaluated to determine if they areallowed. If the command or operation is allowed, then the second device116 executes the command or operation. If the command or operation isnot allowed or considered to jeopardize the binding of the file 212, theuser may also be provided a warning message, such as via a pop-window.The restriction of the operation or the command is then permitteddepending, for example, on the policy or business rules associated withthe file 212 and the binding of the file 212 to the PDL 114.

FIGS. 4A-4C show exemplary block diagrams of a computing deviceaccessing a file that has been bound to a personal data locker inaccordance with embodiments of the present disclosure. The second device116 may be running an operating system (O/S) 400 and a clientapplication 402 that a user may use to access a file. As shown in FIGS.4A-4C, the second device 116, such as a laptop computer, smart phone,tablet computer, and the like, may be coupled to the PDL 114 via a wiredor wireless connection. For example, the second device 116 may becoupled to the PDL 114 via a USB, Firewire, or SATA connection or awireless protocol, such as, for example, BlueTooth®. The second device116 may also comprise a storage 404, which is unprotected, and othermemory or storage devices, such as a USB drive 406.

Referring now to FIG. 4A, the client application 402, such as a wordprocessor, spreadsheet, etc., has been modified based on a plug-in 408.The plug-in 408 restricts or prevents various operations of the clientapplication 402. As noted, operations of the client application 402 thatmay be restricted or prevented may include edit, copy, save, save as,new, printing, rename, open with, etc. In addition, in this embodiment,the applications running on the second device 116 are restricted orprevented from saving to a location other than the PDL 114. Moreover, asshown in FIG. 4B, the second device 116 may be restricted from certainoperations with its storage 404 and another storage device, such as USBdrive 406.

The plug-in 408 may be provided to the second device 116 from the PDL114 by the binding application 214. For example, upon start up or beingconnected to the second device 116, the PDL 114 may automaticallyinstall the plug-in 408 in to the second device 116. Alternatively, thesecond device 116 may obtain the plug-in from another location ordevice, such as external authority 108 or a server connected to network106 (not shown in FIG. 4A). For example, upon being connected to the PDL114, the second device 116 may be redirected with or without userinteraction to external authority 108 or a website to obtain the plug-in408.

As also shown, the plug-in 408 may implement a set of policies orbusiness rules. For example, the plug-in 408 may modify clientapplications 402 running on the second device 116 to prevent them fromallowing operations, such as “Save as”, “Rename”, “Print”, etc. Theplug-in 408 may implement these modifications by removing or makingun-selectable various menu items, such as those commonly provided inapplications like Microsoft Word, Excel, Powerpoint, etc.

Such policies or business rules may be specified in a policy file 410.The policy file may be provided to the second device 116 from the PDL114 by the binding application 214. Alternatively, the second device 116may obtain the policy file 410 from another location or device, such asexternal authority 108 or a server connected to network 106 (not shownin FIG. 4A). Of note, the policies specified in policy file 410 may alsobe revoked or otherwise modified based on various criteria, such asnumber of devices, time, date, and the like.

Referring now to FIG. 4B, the second device 116 may be restricted inaccessing the file 212 on the PDL 114 based on the driver softwareexecuted by the second device 116. As shown, the client application 402,such as a word processor, spreadsheet, etc., works in conjunction with adriver 412 that is specific or unique to the PDL 114. The driver 412restricts or prevents various operations of the client application 402.As noted, operations of the client application 402 that may berestricted or prevented may include edit, copy, save, save as, new,printing, rename, open with, etc. In addition, the applications runningon the second device 116 are restricted or prevented from saving to alocation other than the PDL 114 by the driver 412. Moreover, as shown inFIG. 4B, the second device 116 may be restricted from certain operationswith its storage 404 and another storage device, such as USB drive 406.

The driver 412 may be provided to the second device 116 from the PDL 114by the binding application 214. For example, upon start up or beingconnected to the second device 116, the PDL 114 may automaticallyinstall the driver 412 in to the second device 116. Alternatively, thesecond device 116 may obtain the driver 412 from another location ordevice, such as external authority 108 or a server connected to network106 (not shown in FIG. 4B). For example, upon being connected to the PDL114, the second device 116 may be redirected with or without userinteraction to external authority 108 or a website to obtain the driver412.

As also shown, the driver 412 may implement a set of policies orbusiness rules. Such policies or business rules may be specified in thepolicy file 410. As noted, the policy file may be provided to the seconddevice 116 from the PDL 114 by the binding application 214.Alternatively, the second device 116 may obtain the policy file 410 fromanother location or device, such as external authority 108 or a serverconnected to network 106 (not shown in FIG. 4B).

Referring now to FIG. 4C, the second device 116 may be restricted inaccessing the file 212 on the PDL 114 based on an operating systemcomponent or other form of program code that monitors the operations orcommands related to the file 212. As shown, the O/S 400 of the seconddevice 116 has been modified with a filter 414. The filter 414, forexample, may be a kernel level exception or filter that has beeninstalled on the second device 116 by the PDL 114. The filter 414 mayalso be implemented as firewall software or a firewall policy running onthe second device 116. The filter 414 may intercept various cut, copy,read, write commands as well as various disk commands and evaluate themrelative to the business rules or policies specified in the policy file410. For example, as shown in FIG. 4C, the filter 414 may continuouslymonitor operations and commands requested on the second device 116 andmay restrict operations related to writing files to its storage 404 andanother storage device, such as USB drive 406. The filter 414 may alsoimplement other types of security features to protect the binding of thefile 212 to the PDL 114. Such security features may include, among otherthings, monitoring outgoing connection attempts; restricting control andaccess to a local network and/or Internet; restricting responses toincoming network traffic received by the second device 116; monitorapplications that are listening for incoming connections; restrict theuser when client application 402 makes a connection attempt to a networkor another device; and the like. In some embodiments, the filter 414 isconfigured to be self-expiring or self-deleting in order to avoidleaving remnants of itself on the computer. In addition, the filter 414may comprise various audit or logging functions to record thetransactions attempted or conducted with the PDL 114. In someembodiments, the filter 414 may also be configured to provide its auditand logging information to another entity, such as external authority108, for analysis and monitoring. The filter 414 may provide suchinformation on a periodic basis or upon the occurrence of variousevents, such as a security breach or request for the information.

The filter 414 may be provided to the second device 116 from the PDL 114by the binding application 214. For example, upon start up or beingconnected to the second device 116, the PDL 114 may automaticallyinstall the filter 414 in to the second device 116. Alternatively, thesecond device 116 may obtain the filter 414 from another location ordevice, such as external authority 108 or a server connected to network106 (not shown in FIG. 4C).

In some embodiments, the filter 414 may also be implemented usingexisting security software installed on the second device 116, such as afirewall or antivirus application. In these embodiments, the binding ofthe file 212 is thus protected using the existing services of suchsecurity software. In other embodiments, the filter 414 may beimplemented as an access control list or other form of file systemconfiguration that restricts the read, write, and modify permissionsthat can be performed for the file 212 or on the PDL 114.

As shown, the filter 414 may implement a set of policies or businessrules. Such policies or business rules are specified in the policy file410. As noted, the policy file may be provided to the second device 116from the PDL 114 by the binding application 214. Alternatively, thesecond device 116 may obtain the policy file 410 from another locationor device, such as external authority 108 or a server connected tonetwork 106 (not shown in FIG. 4C).

FIGS. 5A-5B illustrate the second device 116 accessing the file 212 thathas been bound to the PDL 114. As shown, the PDL 114 is coupled to thesecond device 116, for example, via a USB or Fire Wire connection. Forexample, within the PDL 114, the control processor 200 (not shown inFIG. 5A) detects a new connection at input/output module 202. Inresponse, second, the PDL 114 may mount and open itself onto the seconddevice 116 as a partition or drive that is interpreted as a read-onlydevice, such as a CD-ROM drive. For example, as noted, the PDL 114 mayimplement a virtual CD (VCD) within its storage 210. The second device116 may then perform an auto-play or auto-run operation to allow programcode from the PDL 114 to execute.

Thus, third, the binding application 214 may commence an authentication,integrity, and authorization check of the second device 116. The bindingapplication 214 may install itself automatically in to the second device116 or execute from the PDL 114 based on a root kit, and the like. Insome embodiments, these operations may be performed transparently to theuser, while in other embodiments, user interaction may be required orrequested. For example, the binding application 214 may cause a message,such as “Checking Device Authorization,” to be displayed on the seconddevice 116 while these checks are being performed.

Fourth, depending on whether the device 116 is authorized, the bindingapplication 214 may allow access to the file 212. For example, thebinding application 214 may cause a message, such as “DeviceAuthorized”, to be displayed on the second device 116. Alternatively, ifthe device 116 is not authorized or configured in such a way thatjeopardizes the security of the file 212, the binding application 214may install program code or other software on to the second device 116.For example, as noted above, the binding application 214 may install anapplication, an application extension, or application plug-in on to thesecond device 116. The binding application 214 may also implementvarious file system level changes in the second device 116. For example,the binding application 214 may specify various file system permissionsat the drive level, volume level, directory level, and/or file level.

In some embodiments, the binding application 214 may perform variouschecks in order to determine what type of software or program code toinstall. For example, the binding application 214 may identify theprocessor, chipset, operating system, and the presence of one or moreapplications as conditions for installing its program code. The bindingapplication 214 may thus modify or select which program code to installbased on this information. Furthermore, the binding application 214 maybe configured to maintain certain parameters while modifying a filebound to the PDL 114. For example, the user or computer may be requiredto maintain membership of an authorized domain or to maintaincommunications with a network or the external authority 108.

In some embodiments, the binding application 214 may be configured tofollow a policy or set of rules when installing its program code. Forexample, the binding application 214 may be allowed to install programcode on Windows operating computers, but restricted or prohibited frominstalling program code on Unix or Linux devices. The bindingapplication 214 may also, at this time, check for any updates regardingthe security of the file 212. For example, the binding application 214may request various network communications via the second device 116with the trusted domain 102 or the external authority 108. The bindingapplication 214 may thus determine whether access to the file 212 hasbeen changed, revoked, or expired. Of course, during the process ofinstalling its program code, the binding application 214 may cause thedisplay of a message, such as “Software Installing”, on the seconddevice 116.

Referring now to FIG. 5B, the second device 116 is shown executing anapplication 402 that has been modified with a plug-in installed from thePDL 114. In the example shown, the client application 402 has beenrestricted from allowing the user to use the “save as” and “print” itemsof its typical “File” menu. In addition, the client application 402 mayonly “save” to the PDL 114 as a storage location.

In addition, the plug-in may modify or restrict other features of theclient application 402. For example, the client application 402 may havevarious restrictions placed on its “copy”, “paste”, “send to”, and“rename” functions. The second device 116 may also be modified toprohibit operations to other storage locations, such as its local harddrive, optical drive, or USB interface. The second device 116 may alsohave its network communications and/or browser applications restrictedin various manners while the file 212 is opened by the clientapplication 402. A wide variety of restrictions to protect the file 212while stored on the PDL 114 may be implemented in the embodiments.

FIGS. 6A-6B illustrate another example of the second device 116accessing the file 212 bound to the PDL 114. In particular, FIGS. 6A and6B illustrate a less intrusive or more transparent way of restrictingthe access of the second device 116 to the file 212. For example, thePDL 114 may control access to the file 212 utilizing operating systemlevel features. In some embodiments, the PDL 116 cooperates with theoperating system 400 of the second device 116 to implement akernel-level filter that intercepts various read and write commandsrequested by the client application 402. Alternatively, the PDL 114 mayutilize existing security features of the operating system 400. Forexample, the PDL 114 may utilize various features of Microsoft Windows'bitlocker or Apple Mac OSX's filevault features to secure itself whencoupled to the second device 116.

As shown, the PDL 114 may be coupled to the second device 116, forexample, via a USB or Fire Wire connection. For example, within the PDL114, the control processor 200 detects a new connection at input/outputmodule 202. In response, second, the PDL 114 may mount and open itselfonto the second device 116 as a partition or drive that is interpretedas a read-only device, such as a CD-ROM drive. As noted, the PDL 114 mayimplement a virtual CD (VCD) within its storage 210. The second device116 may then perform an auto-play or auto-run operation to allow programcode from the PDL 114 to execute.

Thus, third, the binding application 214 may commence an authentication,integrity, and authorization check of the second device 116. The bindingapplication 214 may install itself automatically in to the second device116 or execute from the PDL 114 based on a root kit, and the like. Insome embodiments, these operations may be performed transparently to theuser, while in other embodiments, user interaction may be required orrequested. For example, the binding application 214 may cause a message,such as “Checking Device Authorization,” to be displayed on the seconddevice 116 while these checks are being performed.

Fourth, depending on whether the device 116 is authorized, the bindingapplication 214 may allow access to the file 212. For example, thebinding application 214 may cause a message, such as “Thank You”, to bedisplayed on the second device 116.

Alternatively, if the device 116 is not authorized or configured in sucha way that jeopardizes the security of the file 212, the bindingapplication 214 may install program code or other software on to thesecond device 116. In these instances, the binding application 214 mayoptionally display a message on the second device 116, such as “ThisDevice is Not Authorized” or “Please Install Software to Authorize thisDevice.” Such a message may be displayed because the program code fromthe binding application 214 may affect various aspects of the operatingsystem 400 running on the second device 116. In other embodiments, thebinding application 214 may attempt to install its program code based onadministrative privileges, such as using a root kit.

The binding application 214 may implement various file systempermissions or access control lists. The binding application 214 mayalso install a kernel level filter within the operating system 400. Thisfilter, such as filter 414, may be configured to intercept commands,such as read/write, cut/copy. In addition, the filter 414 may evaluateand, if needed, restrict disk I/O operations, network communications,and other I/O operations, such as USB operations. The bindingapplication 214 may also implement various file system level changes inthe second device 116. For example, the binding application 214 mayspecify various file system permissions at the drive level, volumelevel, directory level, and/or file level. Furthermore, as noted, thebinding application 214 may cooperate with various security utilitiesprovided by the operating system 400 of the second device 116, such asbitlocker for Windows devices and filevault for Mac devices.Accordingly, the binding application 214 may leverage various servicesof these security utilities, such as encryption services, policyenforcement, etc. to restrict the access to the file 212.

In some embodiments, the binding application 214 may perform variouschecks in order to determine what type of software or program code toinstall. For example, the binding application 214 may identify theprocessor, chipset, operating system, and the presence of one or moreapplications as conditions for installing its program code. The bindingapplication 214 may thus modify or select which program code to installbased on this information.

In some embodiments, the binding application 214 may be configured tofollow a policy or set of rules when installing its program code. Forexample, the binding application 214 may be allowed to install programcode on Windows operating computers, but restricted or prohibited frominstalling program code on Unix or Linux devices. The bindingapplication 214 may also, at this time, check for any updates regardingthe security of the file 212. For example, the binding application 214may request various network communications via the second device 116with the trusted domain 102 or the external authority 108. The bindingapplication 214 may thus determine whether access to the file 212 hasbeen changed, revoked, or expired. Of course, during the process ofinstalling its program code, the binding application 214 may cause thedisplay of a message, such as “Software Installing”, on the seconddevice 116.

Referring now to FIG. 6B, the second device 116 is shown executing anapplication 402. In the example shown, the client application 402 hasnot been directly modified. Instead, operations by the clientapplication 402, have been restricted to prevent the user from usingoperations like the “save as” and “print” items of its typical “File”menu. Such operations are ultimately evaluated as requests to theoperating system 400, which are then checked by the filter 414. In someembodiments, the filter 414 may refer to a policy file 410 that containsthe rules or policies assigned to the file 212.

In addition to various operations by the client application 402, thesecond device 116 may also restricted by the filter 414 with operationsto other storage locations, such as its local hard drive, optical drive,or USB interface. The second device 116 may also have its networkcommunications and/or browser applications restricted in various mannerswhile the file 212 is opened by the client application 402. A widevariety of restrictions to protect the file 212 while stored on the PDL114 may be implemented in the embodiments.

Other embodiments will be apparent to those skilled in the art fromconsideration of the specification and practice of the embodimentdisclosed herein. For example, the PDL may wrap its secured files andrequire the execution of a special purpose application or viewer. Thus,these files may only be accessed upon the launching of a specificunderlying application that has been installed from the PDL or executedfrom the PDL. It is intended that the specification and examples beconsidered as exemplary only, with a true scope and spirit of theembodiment being indicated by the following claims.

What is claimed is:
 1. A method, comprising: saving a file to a datastorage device; binding the saved file to the data storage device torestrict access to the saved file; determining when the data storagedevice has been accessed by a computing device; installing program codeon the computing device if the program code was not previously installedon the computing device, the program code being configured to at leastrestrict access by the computing device to the bound file according to apolicy; causing the computing device to execute the installed programcode; and restricting access, by the computing device executing theprogram code, to the bound file according to the policy.
 2. The methodof claim 1, wherein restricting access includes restricting at least oneof opening the bound file, editing the bound file, saving the boundfile, moving the bound file and deleting the bound file.
 3. The methodof claim 1, wherein determining comprises determining when one of awired and a wireless connection to the data storage device has beenestablished.
 4. The method of claim 1, wherein the data storage devicecomprises a network attached storage (NAS) data storage device.
 5. Themethod of claim 1, wherein the policy is date restricted.
 6. The methodof claim 1, wherein the policy is configured to be selectively one ofrevoked and modified, based upon predetermined criteria.
 7. A datastorage device, comprising: a storage medium for storing at least onefile; program code stored on the storage medium, the stored program codebeing configured to restrict access to the at least one file; acommunications interface; and a processor, configured by instructionsto: save the at least one file to the storage medium; bind the at leastone file to the data storage device to selectively restrict accessthereto; determine when the data storage device has been accessed by acomputing device over the communication interface; and cause the storedprogram code to install on the computing device if the stored programcode was not previously installed on the computing device; wherein theinstalled program code is further configured to execute on the computingdevice and to restrict access by the computing device to the at leastone file bound to the data storage device according to a policy.
 8. Thedata storage device of claim 7, wherein the stored program code isconfigured to restrict at least one of opening the bound at least onefile, editing the bound at least one file, saving the bound at least onefile, moving the bound at least one file and deleting the bound at leastone file.
 9. The data storage device of claim 7, wherein thecommunication interface comprises at least one of a wired and a wirelesscommunications interface.
 10. The data storage device of claim 7,wherein the data storage device comprises a network attached storage(NAS) data storage device.
 11. The data storage device of claim 7,wherein the policy is date restricted.
 12. The data storage device ofclaim 7, wherein the policy is configured to be selectively one ofrevoked and modified, based upon predetermined criteria.
 13. A method,comprising: saving and binding a file to a data storage device;determining when the data storage device has been accessed by acomputing device; obtaining at least a policy from an external authoritycoupled to a computer network, the policy being configured toselectively restrict access to and use of the file; installing programcode on the computing device if the program code was not previouslyinstalled on the computing device, the program code being configured toenable restricting access and use of the bound file according to thepolicy; causing the computing device to execute the installed programcode; and restricting access to and use of the bound file according tothe policy by the computing device executing the program code.
 14. Themethod of claim 13, further comprising obtaining the program code fromone of the external authority and another location coupled to thecomputer network.
 15. The method of claim 13, wherein the policy isconfigured to require accessing the external authority over the computernetwork for authentication and authorization information related to atleast one of access and use of the bound file.
 16. The method of claim13, further comprising accessing the external authority over thecomputer network to obtain therefrom updates to at least one of thepolicy and the program code.
 17. The method of claim 13, wherein theprogram code is further configured to log accesses and uses of the boundfile.
 18. The method of claim 13, wherein the bound file is encryptedand wherein the method further comprises obtaining an encryption keyfrom the external authority over the computer network.
 19. A datastorage device, comprising: a storage medium configured to store a file;program code stored on the storage medium, the stored program code beingconfigured to restrict access to the stored file; a communicationsinterface; and a processor, configured by instructions to: save and bindthe file to the data storage device; determine when the data storagedevice has been accessed by a computing device over the communicationinterface; obtain at least a policy from an external authority coupledto a computer network, the policy being configured to selectivelyrestrict access to and use of the bound file by the accessing computingdevice; and install program code on the accessing computing device ifthe program code was not previously installed on the accessing computingdevice, the program code being configured to enable restricting accessand use of the bound file according to the policy; wherein the installedprogram code is further configured to execute on the accessing computingdevice and to restrict access, according to a policy, by the accessingcomputing device to the file bound to the data storage device.
 20. Thedata storage device of claim 19, wherein the data storage device isfurther configured to obtain the program code from one of the externalauthority and another location coupled to the computer network.
 21. Thedata storage device of claim 19, wherein the policy is configured torequire accessing the external authority over the computer network forauthentication and authorization information related to at least one ofaccess and use of the bound file.
 22. The data storage device of claim19, wherein the data storage device is further configured to access theexternal authority over the computer network to obtain therefrom updatesto at least one of the policy and the program code.
 23. The data storagedevice of claim 19, wherein the program code is further configured tolog accesses and uses of the bound file.
 24. The data storage device ofclaim 19, wherein the bound file is encrypted and wherein the datastorage device is further configured to obtain an encryption key fromthe external authority over the computer network.